Semgrep
Last updated
Was this helpful?
Last updated
Was this helpful?
Semgrep is a fast, open-source, static analysis engine for finding bugs, detecting vulnerabilities in third-party dependencies, and enforcing code standards. Semgrep analyzes code locally on your computer or in your build environment: code is never uploaded.
Semgrep supports 30+ languages.
GA
C# · Go · Java · JavaScript · JSX · JSON · PHP · Python · Ruby · Scala · Terraform · TypeScript · TSX
Beta
Kotlin · Rust
Experimental
Bash · C · C++ · Clojure · Dart · Dockerfile · Elixir · HTML · Julia · Jsonnet · Lisp · Lua · OCaml · R · Scheme · Solidity · Swift · YAML · XML · Generic (ERB, Jinja, etc.)
Install Semgrep CLI
Go to your app's root directory and run semgrep scan --config auto. This will scan your project with the default settings.
[Optional, but recommended] Run semgrep login to get the login URL for the Semgrep Cloud Platform. Open the login URL in the browser and login.
Explore the demo app
Scan your project by navigating to Projects > Scan New Project > Run scan in CI
Select your version control system and follow the wizard to add your project. After this setup, Semgrep will scan your project after every pull request.
[Optional but recommended] If you want to run Semgrep locally, follow the steps in the CLI section.
The Semgrep ecosystem includes the following products:
Semgrep OSS Engine - The open-source engine at the heart of everything (this project).
and:
Join hundreds of thousands of other developers and security engineers already using Semgrep at companies like GitLab, Dropbox, Slack, Figma, Shopify, HashiCorp, Snowflake, and Trail of Bits.
Semgrep rules look like the code you already write; no abstract syntax trees, regex wrestling, or painful DSLs. Here's a quick rule for finding Python print() statements.
Examples
Ban dangerous APIs
Search routes and authentication
Enforce the use secure defaults
Tainted data flowing into sinks
Enforce project best-practices
Codify project-specific knowledge
Audit security hotspots
Audit configuration files
Migrate from deprecated APIs
Apply automatic fixes
Using configs from local files (like --config=xyz.yml) does not enable metrics.
To disable Registry rule metrics, use --metrics=off.
To upgrade, run the command below associated with how you installed Semgrep:
For beginners, we recommend starting with the because it provides a visual interface, a demo project, result triaging and exploration workflows, and makes setup in CI/CD fast. Scans are still local and code isn't uploaded. Alternatively, you can also start with the CLI without logging in and navigate the terminal output to run one-off searches.
Register to
Visit to learn more about auto config and other rules.
If there are any issues, please ask in the Smegrep Slack group
To run Semgrep Supply Chain, . Visit the to learn more.
- Deploy, manage, and monitor SAST and SCA at scale using Semgrep, with . Integrates with continuous integration (CI) providers such as GitHub, GitLab, CircleCI, and more.
- Scan your code with Semgrep's Pro rules and Semgrep Pro Engine to find OWASP Top 10 vulnerabilities and protect against critical security risks specific to your organization. Semgrep Code provides both Community (free) and Team (paid) tiers.
- A high-signal dependency scanner that detects reachable vulnerabilities in open source third-party libraries and functions across the software development life cycle (SDLC). Semgrep Supply Chain is available on Team (paid) tiers.
- An online interactive tool for writing and sharing rules.
- 2,000+ community-driven rules covering security, correctness, and dependency vulnerabilities.
Semgrep is developed and commercially supported by .
Run it online in Semgrep’s Playground by .
Visit for use cases and ideas.
,
,
, ,
Visit to learn about using Semgrep in your editor or pre-commit. When integrated into CI and configured to scan pull requests, Semgrep will only report issues introduced by that pull request; this lets you start using Semgrep without fixing or ignoring pre-existing issues!
Browse the full Semgrep . If you’re new to Semgrep, check out or the .
Using remote configuration from the (like --config=p/ci) reports pseudonymous rule metrics to semgrep.dev.
The Semgrep describes the principles that guide data-collection decisions and the breakdown of the data that are and are not collected when the metrics are enabled.
